Create VPN Connection

Configure AWS Site-to-Site VPN Connection

ℹ️ Overview

  • In this section, we will set up a VPN connection between the VPC and the on-premises environment.
  • Use a Virtual Private Gateway as the AWS-side VPN endpoint.
  • Configure static routing to route traffic through the VPN tunnel.

Create VPN Connection

  1. Go to the AWS VPC Console
    • Navigate to Site-to-Site VPN Connections
    • Click Create VPN Connection

Create VPC

  1. Basic VPN Connection Configuration
    • Name tag: Enter VPN Connection
    • Target Gateway Type: Select Virtual Private Gateway
    • Virtual Private Gateway: Select the previously created VPN Gateway
    • Customer Gateway: Choose Existing
    • Customer Gateway ID: Select the previously created Customer Gateway

Create VPC

  1. Routing Configuration

    • Routing Options: Choose Static
    • Static IP Prefixes: Enter 10.11.0.0/16 (CIDR of the on-premises environment)
    • Keep the default tunnel configurations

    💡 Static vs Dynamic Routing:

    • Static: Simple, suitable for labs and small environments
    • Dynamic (BGP): Automatic, suitable for production with many routes

Create VPC

  1. Launch the VPN Connection
    • Review the configuration
    • Click Create VPN Connection

Create VPC

⚠️ Note

  • VPN creation may take 5–10 minutes
  • Wait until the status changes to Available before proceeding

Create VPC

Configure Route Propagation

  1. Configure the Public Route Table
    • Go to Route Tables in the VPC Console
    • Select the route table for the Public subnet (ASG VPC)
    • Open the Route Propagation tab
    • Click Edit route propagation

Create VPC

  1. Enable Route Propagation

    • Enable propagation for the Virtual Private Gateway
    • Click Save

    💡 Route Propagation: Automatically adds routes from VPN to route table without manual configuration

Create VPC

  1. Verify Status
    • Ensure that Route Propagation shows Yes
    • Route to 10.11.0.0/16 will appear automatically

Create VPC

  1. Repeat for the Private Route Table
    • Select Private Route Table (ASG VPC)
    • Perform the same steps
    • Ensure route propagation is enabled

Create VPC Create VPC Create VPC

🏗️ VPN Connection Architecture

AWS VPC (10.10.0.0/16)
    ↓
Virtual Private Gateway
    ↓
VPN Connection (2 tunnels for redundancy)
    ├── Tunnel 1: Active
    └── Tunnel 2: Standby
    ↓
Customer Gateway (10.11.0.0/16)

💡 Key Concepts:

  • VPN Connection: Creates 2 IPsec tunnels for high availability
  • Static Routes: Manually configured routes (10.11.0.0/16)
  • Route Propagation: Automatically updates route tables with VPN routes
  • Tunnel Status: Will be “DOWN” until Customer Gateway is configured

🔒 Security Note

  • Route propagation automatically updates routing tables when changes occur
  • Enable propagation only for necessary route tables
  • Verify propagated routes are correct

⚠️ Next Steps: VPN tunnels are currently DOWN. Need to configure Libreswan on Customer Gateway to bring tunnels UP!

✅ Completed: VPN Connection is created and route propagation is configured!